Privacy Policy
Last updated 26 October 2026
This policy explains what personal data Slen collects, why, where it is kept and for how long, and what you can do about it. The rules for using Slen are in the Terms of Service.
1. Who is responsible
Slen operates Slen and is responsible for the personal data described here (the “controller”). For anything about your data, write to support@slen.ai.
This policy covers the website slen.ai, the console at app.slen.ai, the Slen API and the SDKs.
2. What we collect
- Account. Your name, email address and the language of the console; whether and when you confirmed the email address; the time of your last sign-in. Your password is never stored as it is — only a one-way hash (bcrypt).
- Google sign-in. If you sign in with Google, we receive from Google your Google account ID, email address, whether Google has verified it, your name and the address of your profile picture. We ask for nothing else.
- Organizations and teams. The organizations and projects you belong to and your role in each; invitations — the invited email address, the role, who invited and when, the expiry.
- Sessions and security. For each signed-in session, the IP address, the browser’s user agent and when it was last used; you see them in the console under Sessions and can sign other sessions out. Management actions — changes to keys, settings and members — are recorded in an audit log with the person or API key, the time and the IP address.
- API keys. Only a hash of each key and its last four characters; the full key is shown to you once.
- Provider connections. The credentials of the AI providers you connect are stored encrypted and shown only by their last four characters.
- Flows and executions. Your flows and their versions. When your application runs a flow, we store the run: its status, cost and timing, the input your application sent, the outputs of its steps and the result — which may include prompts and model answers if your flow passes them. A run that waits (for example, for an approval) is stored encrypted while it waits. If a flow uses a response cache, model answers are kept in the cache for the time the flow sets.
- Your customers. If you use customer credits, the identifier you give each of your customers, their balances and their credit history. We do not ask for your customers’ names or emails.
- Usage and spending. Requests, token counts, estimated and actual costs, budget usage — the records that make budgets, analytics and the ledger work. These are not request texts.
- Emails. We send account emails — address confirmation, password reset, invitations — and notification emails about alerts and approvals, which you can turn off in the console or with the unsubscribe link each of them carries. Our mail logs record the delivery with a hash of the recipient, not the address.
- Notifications. If you or your organization connect a messenger to receive notifications: for a Telegram chat or group, its ID and type and, for a personal chat, your Telegram user ID, username and first name, or, for a group, its title — stored encrypted, with the username, name or title also kept as the visible name of the channel; for Slack, Microsoft Teams and Discord, the address of the webhook — stored encrypted and shown only by its host and last four characters. We also keep your notification settings — what you subscribe to, quiet hours and time zone — and a log of each notification delivery: when, which event, which channel and the outcome.
- Technical logs. Our web servers record requests (IP address, time, address requested, browser) to run and secure the Service.
3. Why we use it
- to provide the Service you signed up for: your account, your organization, running your flows and showing their results — this is necessary for our agreement with you;
- to keep the Service and your account secure — rate limits, sessions, the audit log — our legitimate interest and yours;
- to send the emails the Service needs — confirmation, password reset, invitations — and the notifications you and your organization set up;
- to comply with the law when it requires us to.
We do not sell personal data, do not show ads, and do not use your data or your requests to train AI models.
4. Data you send about your own users
When your application sends Slen data about your own users — text in a prompt, a customer identifier — you decide what is sent and why, and we process it on your behalf, only to run your flows (we are your “processor”). You are responsible for the legal basis for it and for informing your users. Through the API you can delete a customer that has no credit history, or block one that has; to have more removed, write to support@slen.ai.
6. Where your data is
Slen’s database and backups are in the European Union (Finland). Emails are delivered from Ireland. The AI providers you connect may process requests in other countries, including the USA, under their own terms — you choose the providers. The same holds for the messengers you send notifications to. Where a provider of ours handles data outside the EU, the transfer relies on the safeguards data-protection law provides for it.
7. How long we keep it
- Your account, organizations, projects, flows and settings — while the account exists, until you ask us to delete them.
- Execution step traces — 30 days.
- Notification deliveries and the events behind them — 30 days.
- Executions and their stored results, requests, provider attempts, operations, policy decisions and webhook deliveries — 90 days.
- Repeat-request (idempotency) records — 7 days.
- The audit log — 365 days.
- The financial records of budgets, reservations and customer credits, and aggregated statistics — for the life of the project, because they are the ledger.
- Database backups — hourly copies for 48 hours, daily copies for 30 days.
When an item is deleted, its copies in backups disappear as the backups expire.
8. Security
Connections to Slen are encrypted (TLS). Passwords are hashed; API keys and one-time links are stored only as hashes; provider credentials, webhook secrets, the addresses of messenger webhooks, Telegram chat identifiers and waiting runs are encrypted. Sign-in, sign-up and password reset are rate-limited. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
10. Your rights
Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, and receive it in a portable form. The console shows your account and lets you sign other sessions out, leave an organization (unless you are its last owner), remove members, revoke invitations and API keys, and turn your notifications off; every notification email also carries a link that unsubscribes you in one click. For anything else — a copy of your data, a correction, deleting your account or your organization — write to support@slen.ai from the address of your account. We will answer within one month.
You can also complain to the data protection authority of your country.
11. Children
Slen is a service for work and is not meant for anyone under 18. We do not knowingly collect data about children.
12. Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we will tell you by email or in the console before it takes effect.
13. Contact
Questions and requests about your data: support@slen.ai.